In the following, automation technology is described in somewhat greater detail: Field devices, which serve for determining and monitoring process variables, are applied in automation technology, especially in process automation technology. Examples of such field devices are fill level measuring devices, flow measuring devices, analytical measuring devices, pressure and temperature measuring devices, humidity and conductivity measuring devices, density and viscosity measuring devices. The sensors of these field devices register the corresponding process variables, e.g. fill level, flow, pH value, substance concentration, pressure, temperature, humidity, conductivity, density or viscosity.
However, the term ‘field devices’ also encompasses actuators, e.g. valves or pumps, via which, for example, the flow of a liquid in a pipeline or the fill level in a container can be changed. A large number of such field devices are available from the firm, Endress+Hauser.
As a rule, field devices in modern automation technology plants as well as in the automobile sector are connected to a superordinated unit via communication networks such as HART Multidrop, point to point connection, Profibus, Foundation Fieldbus, CAN bus; the superordinated unit is referred to as a control system or superordinated control unit. This superordinated unit serves for control, diagnosis, visualization, monitoring, as well as for the start up and servicing of the field devices. Supplemental components necessary for the operation of fieldbus systems, directly connected to a fieldbus and serving especially for communication with the superordinated units, are likewise frequently referred to as field devices. These supplemental components include e.g. remote I/Os, gateways, linking devices, controllers, wireless adapters, etc. These also fall under the terminology, ‘field devices’.
The software fraction of field devices is steadily increasing. The advantage in the use of intelligent field devices (smart field devices) controlled by microcontrollers is that a large number of different functionalities can be implemented in a field device using application specific, software programs; program changes can also be made relatively simply. On the other hand, the high flexibility of program controlled, field devices is countered by having a relatively low processing speed and therewith a correspondingly low measuring rate as a result of the sequential progression through the program.
In order to increase the processing speed, ASICs—Application Specific Integrated Circuits—are used in field devices, when it is economically justifiable. Through an application specific configuration, these chips can process data and signals significantly faster than a software program. Consequently, ASICs are especially excellently suitable for computationally intensive applications.
Disadvantageous in the case of ASICs is that their functionality is fixed after creation. Subsequent change of the functionality of these chips is not readily possible. Furthermore, the use of ASICs pays off only with relatively large piece numbers, since the developmental effort and the costs connected therewith are high.
A configurable field device, in which a reconfigurable logic chip in the form of an FPGA (Field-Programmable Gate Array) is provided, in order to avoid the drawback of fixed functionality, is known from WO 03/098154 A1. In this known solution, the logic chip is configured with at least one microcontroller, which is also referred to as an embedded controller, at system startup. After the configuration is finished, the required software is loaded in the microcontroller. The reconfigurable logic chip here required must make use of sufficient resources, namely logic, wiring and memory resources, in order to fulfill the desired functionalities. Logic chips with many resources require much energy, which, in turn, makes its use in automation only limitedly possible from a functional point of view. A disadvantage in the use of logic chips with few resources and, thus, with lower energy consumption is the occasionally considerable limitation in the functionality of the corresponding field device.
Depending on application, field devices must satisfy the most varied of safety requirements. In order to satisfy relevant safety requirements, e.g. the SIL-standard ‘security integrity level’, which plays a large role in process automation, the functionality of the field devices must, moreover, be redundantly and/or diversely designed.
Redundancy means increased safety through the doubled or multiple designing of all safety relevant, hardware and software components. Diversity means that the hardware components, such as e.g. a microprocessor or an A/D converter, located in the different measuring paths come from different manufacturers and/or that they are of different types. In the case of software components, diversity requires that software stored in the microprocessors originate from different sources, e.g. different manufacturers or programmers. Through all these measures, it should be assured that a safety critical failure of the field device as well as the occurrence of simultaneously arising systematic errors in the measured value are excluded with high probability. Supplementally, it is also known to design individual essential hardware and software components of the evaluating circuit redundantly and/or diversely. The redundant and diverse design of individual hardware and software components can further increase the degree of safety.
An example of a safety relevant application is monitoring fill level in a tank, in which a burnable, explosive liquid, or also a non combustible liquid that is endangering to the environment, is stored. Here it must be assured that the supply of liquid to the tank is immediately interrupted as soon as a maximum reliable fill level is achieved. This, in turn, requires that the measuring device detects the fill level with high reliability and works faultlessly.
A field device is known from WO 2009/062954 A1 that has a sensor, which works according to a defined measuring principle, and a control/evaluation unit, which conditions and evaluates the measurement data delivered by the sensor along at least two equal measuring paths as a function of a safety standard required in the respective safety critical application. The control/evaluation unit is at least partially embodied as a reconfigurable logic chip with a plurality of partially dynamically reconfigurable function modules. The control/evaluation unit configures the function modules in the measuring paths as a function of the defined safety critical application in such a manner that the field device is correspondingly designed to fulfill the required safety standard.
Problematic in the case of the known embodiment is that a malfunction, e.g. a short circuit or a temperature change, in one section automatically influences other sections. There is crosstalk to other sections, so that the field device can deliver defective measurement results and no longer works reliably. This presents a high risk, especially in safety critical applications, which is not acceptable.
The not pre-published DE 10 2010 002 346.9, filed on Feb. 25, 2010, describes a field device, in which the control/evaluation unit is realized on a single FPGA chip. A standard FPGA chip is utilized. In such case, at least a first section and a second section are provided on the FPGA chip. In each section, a digital measuring path is partially dynamically reconfigurable; the measuring path comprises a plurality of software based and/or hardware based function modules. The individual sections are isolated from one another by permanently configured spacing regions or forbidden regions, wherein the spacing regions are embodied so that a temperature and/or a voltage change in one of the sections does not influence the other section or the other sections and that no connection arises between the sections in the case of malfunction. The control/evaluation unit partially dynamically reconfigures the function modules in the measuring paths as a function of each defined safety critical application in such a manner that the field device fulfills the required safety standard. ‘Partially dynamically reconfigurable’ means that the function modules of the FPGA in the corresponding measuring path are reconfigured during run time, i.e. dynamically. This is especially important when a malfunction occurs. One such malfunction is brought about, for example, by incoming gamma or cosmic radiation, thus high energy radiation, which changes or shuts down the functioning of one or a plurality of logic blocks or logic components or other resources.